Elastic Cloud Hosted deployments that have been encrypted with AWS KMS keys also support AWS KMS key security policies and features, such as key rotation and key revocation. Key rotation minimizes the risk of data leaks due to key compromise. Key revocation is an additional security measure, where access to encrypted data via a compromised key is terminated, either via disabling/deleting the key or by changing the key’s IAM policy.
AWS KMS keys are automatically rotated after one year by default, but this rotation period can be customized. KMS keys can also be manually rotated within AWS as necessary. Elastic seamlessly handles AWS KMS key rotations so the data in your Elastic Cloud deployment will remain encrypted and accessible via your most current AWS KMS key.
If the current key is ever compromised, you can manually revoke the key in AWS KMS. This is a “break-glass” operation to use in case of a security breach. No more than 30 minutes from when a key is revoked, Elastic Cloud will lock the deployment’s data directories and prompt you to delete the deployment. You can restore the key if it’s unintentionally revoked. The deployment will resume operation once the key is restored.
Leave a Reply